Why webhook URLs must be public HTTPS

HTTPS requirement

Publisher webhooks must use public HTTPS endpoints on the allowed ports.

Private destinations are rejected

Loopback, private network and reserved destinations are rejected so a user cannot turn webhook delivery into a request to internal infrastructure.

If your development endpoint is local

Expose a controlled HTTPS test endpoint through an appropriate development tunnel, or test on a staging host that is publicly reachable and protected.